Microsoft (MS) worked with Japanese police to block cybercrime infrastructure used to spread more than 1 billion phishing messages worldwide. The move targeted a criminal ecosystem that enabled large-scale fraud by combining sales of hijacked accounts with tools for creating fake websites.

On Oct. 14, local time, IT outlet The Verge reported that MS, after investigating with Japan's National Police Agency, tracked the illegal account marketplace YAM Store and phishing tools CoGUI and Iron Man.

MS said the services since January supported sending more than 1 billion malicious emails and text messages targeting more than 75,000 organisations in over 150 countries. More than 750 million of those messages targeted MS customers, and operators were believed to have earned tens of millions of dollars in revenue.

YAM Store sold stolen or fraudulently issued MS and Google accounts, as well as criminal infrastructure. Operators obtained domains that real organisations had used and allowed to expire, rebuilt websites and used them to obtain MS365 accounts for resale.

CoGUI provided fake webpages and messages impersonating companies and financial institutions. A follow-on service, Iron Man, had more than 2,300 templates for impersonating banks, police and government agencies, enabling criminals to easily carry out phishing attacks.

The investigation began late last year after Japan's National Police Agency provided MS with information related to fraud 피해 in the country. The Japan Cybercrime Countermeasures Center (JC3) and several security companies also took part.

MS, under a U.S. court order, seized core operating domains with healthcare cybersecurity collaboration group Health-ISAC and rerouted access paths. It also disabled more than 20,000 accounts linked to YAM Store and blocked more than 100,000 domains used for impersonation and fraud.

MS said the action was meaningful in that it neutralised criminal infrastructure that supplies accounts and phishing tools, beyond individual fraudsters.